nzb-search
Pass
Audited by Gen Agent Trust Hub on Mar 29, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a local Bash script (
scripts/nzb-api.sh) to perform search and download operations. The script employs a whitelist for its primary operations and correctly handles shell arguments. - [CREDENTIALS_UNSAFE]: The skill implements secure credential management by retrieving API keys via the Unix 'pass' utility instead of hardcoding secrets or environment variables.
- [EXTERNAL_DOWNLOADS]: The skill is designed to download NZB files (XML documents) from the user-configured Usenet indexers. These files are stored locally as requested by the user and are not executed.
- [PROMPT_INJECTION]: The skill processes and displays external metadata (titles, NFO files) from Usenet indexers. This represents a standard surface for indirect prompt injection common to search tools, but the skill contains no logic to bypass safety guidelines or override agent behavior.
Audit Metadata